{
  "cveId": "CVE-2026-74366",
  "url": "https://patchblox.com/security/cve/CVE-2026-74366",
  "summary": "CVE-2026-74366 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74366 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix NULL deref in change_sta_links...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix NULL deref in change_sta_links for unready link  _ieee80211_set_active_links() calls _ieee80211_link_use_channel() for each newly-added link and WARN_ON_ONCE()s if it fails. The call uses assign_on_failure=true, which allows mac80211 to continue despite driver failures, but when a mac80211-level channel validation fails (e.g., combinations check, DFS, or no available radio), drv_assign_vif_chanctx() is never reached. Since ath12k_mac_vdev_create() is only called from that path, arvif-\u003Eis_created remains false and arvif-\u003Ear remains NULL for the failed link.  The subsequent drv_change_sta_links() call reaches ath12k_mac_op_change_sta_links(), which allocates an arsta and sets ahsta-\u003Elinks_map |= BIT(link_id) for the broken link before checking whether the link is ready. When the vdev was never created, only station_add() is skipped, but the link remains in links_map.  Any subsequent operation iterating links_map and dereferencing arvif-\u003Ear without a NULL check will crash. Two observed examples are NULL deref in ath12k_mac_ml_station_remove() on disconnect and in ath12k_mac_op_set_key() when wpa_supplicant installs PTK keys.    BUG: Unable to handle kernel NULL pointer dereference at 0x00000000   pc : ath12k_mac_station_post_remove\u002B0x40/0xe8 [ath12k]   Call trace:    ath12k_mac_station_post_remove\u002B0x40/0xe8 [ath12k]    ath12k_mac_op_sta_state\u002B0xb60/0x1720 [ath12k]    drv_sta_state\u002B0x100/0xbd8 [mac80211]    __sta_info_destroy_part2\u002B0x148/0x178 [mac80211]    ieee80211_set_disassoc\u002B0x500/0x678 [mac80211]    BUG: Unable to handle kernel NULL pointer dereference at 0x00000000   pc : ath12k_mac_op_set_key\u002B0x1f8/0x2c0 [ath12k]   Call trace:    ath12k_mac_op_set_key\u002B0x1f8/0x2c0 [ath12k]    drv_set_key\u002B0x70/0x100 [mac80211]    ieee80211_key_enable_hw_accel\u002B0x78/0x260 [mac80211]    ieee80211_add_key\u002B0x16c/0x2ac [mac80211]    nl80211_new_key\u002B0x138/0x280 [cfg80211]  Fix this by checking arvif-\u003Eis_created before calling ath12k_mac_alloc_assign_link_sta(). This prevents the broken link from entering links_map, so all subsequent operations iterating the bitmap are protected. The reliability of arvif-\u003Eis_created across all error paths is ensured by the preceding patch.  Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3",
  "published": "2026-08-15T06:22:38Z",
  "severity": "",
  "epss": 0.00206,
  "epssPercentile": 0.10765,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-74366",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74366",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}